Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/db/src/index.ts

@@ -28,15 +28,32 @@ export function getPool(): pg.Pool {
     throw new Error('DATABASE_URL is not set');
   }
 
+  const isProd = process.env.NODE_ENV === 'production';
   const caPath = process.env.DATABASE_CA_CERT_PATH;
   const ca = caPath && fs.existsSync(caPath) ? fs.readFileSync(caPath, 'utf8') : undefined;
 
   // Strip sslmode from the URL so our explicit `ssl` option fully controls TLS behavior.
-  // Without this, pg merges URL-derived settings and may force cert verification even when
-  // we want to fall back to TLS-without-verification (no CA cert available).
-  const ssl: pg.PoolConfig['ssl'] = ca
-    ? { ca, rejectUnauthorized: true }
-    : { rejectUnauthorized: false };
+  // Without this, pg merges URL-derived settings which can conflict with the options below.
+  let ssl: pg.PoolConfig['ssl'];
+  if (ca) {
+    // Verified TLS against the managed-DB CA — the correct posture everywhere.
+    ssl = { ca, rejectUnauthorized: true };
+  } else if (isProd) {
+    // Never run production against the database over unverified TLS: fail fast so a missing
+    // CA cert is a loud deploy error instead of a silent man-in-the-middle exposure.
+    throw new Error(
+      'DATABASE_CA_CERT_PATH is required in production: point it at the managed-DB CA cert so TLS certificates are verified (rejectUnauthorized: true).',
+    );
+  } else {
+    // Dev only, and only when no CA cert is present. Verification is disabled — connecting to a
+    // production database like this is still MITM-exposed, so warn loudly.
+    // eslint-disable-next-line no-console
+    console.warn(
+      '[db] WARNING: no DATABASE_CA_CERT_PATH — connecting with TLS certificate verification DISABLED. ' +
+        'Add the CA cert (certs/ca-certificate.crt) to verify the connection.',
+    );
+    ssl = { rejectUnauthorized: false };
+  }
 
   _pool = new pg.Pool({
     connectionString: stripSslmode(connectionString),